Support

No, Admin Tools can't protect you against Open Redirection attacks. These are faults in the handling of otherwise innocuous user data inside your business logic. Admin Tools can protect you only against two related kinds of attacks, Cross Site Scripting (a.k.a. XSS, the attacker using malicious crafted data to force an Open Redirect through Javascript) and CSRF (Cross Site Request Forgery, making your site the target of an XSS or Open Redirect attack). In order to protect your users against Open Redirect you must make sure that any URL entered by a visitor will not cause under any circumstances a blind (immediate, without warning) redirection to the malicious URL.

The reason why Admin Tools can't protect you against an Open Redirect attack is that since it can't know the context of the query string parameters, it would end up blocking all requests containing a URL in the request parameters. This would throw too many false positives to be useful.

For what is worth, up-to-date versions of Joomla! do not suffer from such attacks, meaning that the core components are not susceptible to such an attack. The major components also do not suffer from this. As usual, you have to exercise caution about what you install on your site and make sure it's always up-to-date.

You're welcome, Steve!